CVE-2026-109310 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan installations should be aware of this vulnerability and take steps to patch vulnerable installations to prevent potential denial-of-service attacks.

Why it matters

Defenders should prioritize patching vulnerable SiYuan installations to prevent potential denial-of-service attacks. The vulnerability allows an attacker to cause resource exhaustion, potentially leading to a denial-of-service condition. Defenders responsible for SiYuan installations should be aware of this vulnerability and take steps to patch vulnerable installations.

• Potential denial-of-service condition
• Resource exhaustion through /api/icon/getDynamicIcon content parameter

Technical summary

The vulnerability exists in SiYuan versions prior to 3.8.6, where the Sprig template function map in the /api/icon/getDynamicIcon content parameter is not restricted. This allows an attacker to cause resource exhaustion, potentially leading to a denial-of-service condition. The vulnerability can be triggered by a publish reader or anyone when publish auth is disabled, using uncapped functions like 'until' to OOM-kill the kernel with one request. The lack of restrictions on the Sprig template function map enables an attacker to exploit this vulnerability, potentially leading to a denial-of-service condition.

Defensive priority

Defenders should prioritize patching vulnerable SiYuan installations to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch vulnerable SiYuan installations to version 3.8.6 or later
• Restrict access to the /api/icon/getDynamicIcon endpoint
• Monitor SiYuan installations for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in SiYuan versions prior to 3.8.6 and the potential for resource exhaustion through the /api/icon/getDynamicIcon content parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.